Analysis
-
max time kernel
149s -
max time network
190s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
24-09-2021 11:55
Static task
static1
Behavioral task
behavioral1
Sample
RFQ_Beijing Chengruisi Manufacturing_pdf.exe
Resource
win7v20210408
General
-
Target
RFQ_Beijing Chengruisi Manufacturing_pdf.exe
-
Size
417KB
-
MD5
a30b50f5e2ea1a2d8c6bdf581e97d478
-
SHA1
9943026649061e28fe7fd626b6d3e1c893131779
-
SHA256
3dafcb39d7cc251c9a8212a8e745e0d72f2c530bf699a9168a379fa25e36ec38
-
SHA512
548ca8b3f795c32ff30d4f4810e78c6a0bb2aecf42a4bc56632612b2ab5595d9d4d3fd364b6c9bcca80135f1459f7243edc020a2b61bb3b1bce04d43d79a8088
Malware Config
Extracted
xloader
2.5
euzn
http://www.heser.net/euzn/
235296tyc.com
gold12guide.art
baibuaherb.com
weberwines.tax
chezvitoria.com
aidenb.tech
pitchdeckservice.com
surgeryforfdf.xyz
workunvaccinated.com
hrtaro.com
yourotcs.com
sonimultispecialityclinic.com
consultantadvisors.com
pentesting-consulting.com
dantechs.digital
longshifa.online
taweilai.net
imyusuke.com
cashndashfinancial.com
fasiglimt.quest
jakital.com
graywolfdesign.com
pepeavatar.com
predixlogisticscourier.com
football-transfer-news.pro
herbalmedication.xyz
esd66.com
janesgalant.quest
abcrefreshments.com
chaoxy.com
rediscoveringyouhealing.com
mcrjadr5.xyz
n4sins.com
faithful-presence.com
013yu.xyz
isystemslanka.com
newbeautydk.com
ethiopia-info.com
hgaffiliates.net
anodynemedicalmassage.com
esohgroup.com
clinicamonicabarros.com
rafathecook.com
londonescort.xyz
dreamites.com
webtiyan.com
cnnautorepair.com
soposhshop.com
aarohaninsight2021.com
arceprojects.com
mecasso.store
mirai-energy.com
barwg.com
angeescollections-shop.com
xinlishiqiaoqiao.xyz
linuxsauce.net
dirbn.com
anandiaper.xyz
blackpanther.online
livinwoodbridgefarms.com
diepraxiskommunikation.com
radiosaptshahid.com
gofieldtest.com
minxtales.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1680-65-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/1680-66-0x000000000041D420-mapping.dmp xloader behavioral1/memory/2028-75-0x00000000000C0000-0x00000000000E9000-memory.dmp xloader -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1216 cmd.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
RFQ_Beijing Chengruisi Manufacturing_pdf.exeRFQ_Beijing Chengruisi Manufacturing_pdf.exeraserver.exedescription pid process target process PID 1696 set thread context of 1680 1696 RFQ_Beijing Chengruisi Manufacturing_pdf.exe RFQ_Beijing Chengruisi Manufacturing_pdf.exe PID 1680 set thread context of 1180 1680 RFQ_Beijing Chengruisi Manufacturing_pdf.exe Explorer.EXE PID 1680 set thread context of 1180 1680 RFQ_Beijing Chengruisi Manufacturing_pdf.exe Explorer.EXE PID 2028 set thread context of 1180 2028 raserver.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 23 IoCs
Processes:
RFQ_Beijing Chengruisi Manufacturing_pdf.exeraserver.exepid process 1680 RFQ_Beijing Chengruisi Manufacturing_pdf.exe 1680 RFQ_Beijing Chengruisi Manufacturing_pdf.exe 1680 RFQ_Beijing Chengruisi Manufacturing_pdf.exe 2028 raserver.exe 2028 raserver.exe 2028 raserver.exe 2028 raserver.exe 2028 raserver.exe 2028 raserver.exe 2028 raserver.exe 2028 raserver.exe 2028 raserver.exe 2028 raserver.exe 2028 raserver.exe 2028 raserver.exe 2028 raserver.exe 2028 raserver.exe 2028 raserver.exe 2028 raserver.exe 2028 raserver.exe 2028 raserver.exe 2028 raserver.exe 2028 raserver.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
RFQ_Beijing Chengruisi Manufacturing_pdf.exeraserver.exepid process 1680 RFQ_Beijing Chengruisi Manufacturing_pdf.exe 1680 RFQ_Beijing Chengruisi Manufacturing_pdf.exe 1680 RFQ_Beijing Chengruisi Manufacturing_pdf.exe 1680 RFQ_Beijing Chengruisi Manufacturing_pdf.exe 2028 raserver.exe 2028 raserver.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
RFQ_Beijing Chengruisi Manufacturing_pdf.exeraserver.exedescription pid process Token: SeDebugPrivilege 1680 RFQ_Beijing Chengruisi Manufacturing_pdf.exe Token: SeDebugPrivilege 2028 raserver.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
Explorer.EXEpid process 1180 Explorer.EXE 1180 Explorer.EXE 1180 Explorer.EXE 1180 Explorer.EXE -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
Explorer.EXEpid process 1180 Explorer.EXE 1180 Explorer.EXE 1180 Explorer.EXE 1180 Explorer.EXE -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
RFQ_Beijing Chengruisi Manufacturing_pdf.exeExplorer.EXEraserver.exedescription pid process target process PID 1696 wrote to memory of 1680 1696 RFQ_Beijing Chengruisi Manufacturing_pdf.exe RFQ_Beijing Chengruisi Manufacturing_pdf.exe PID 1696 wrote to memory of 1680 1696 RFQ_Beijing Chengruisi Manufacturing_pdf.exe RFQ_Beijing Chengruisi Manufacturing_pdf.exe PID 1696 wrote to memory of 1680 1696 RFQ_Beijing Chengruisi Manufacturing_pdf.exe RFQ_Beijing Chengruisi Manufacturing_pdf.exe PID 1696 wrote to memory of 1680 1696 RFQ_Beijing Chengruisi Manufacturing_pdf.exe RFQ_Beijing Chengruisi Manufacturing_pdf.exe PID 1696 wrote to memory of 1680 1696 RFQ_Beijing Chengruisi Manufacturing_pdf.exe RFQ_Beijing Chengruisi Manufacturing_pdf.exe PID 1696 wrote to memory of 1680 1696 RFQ_Beijing Chengruisi Manufacturing_pdf.exe RFQ_Beijing Chengruisi Manufacturing_pdf.exe PID 1696 wrote to memory of 1680 1696 RFQ_Beijing Chengruisi Manufacturing_pdf.exe RFQ_Beijing Chengruisi Manufacturing_pdf.exe PID 1180 wrote to memory of 2028 1180 Explorer.EXE raserver.exe PID 1180 wrote to memory of 2028 1180 Explorer.EXE raserver.exe PID 1180 wrote to memory of 2028 1180 Explorer.EXE raserver.exe PID 1180 wrote to memory of 2028 1180 Explorer.EXE raserver.exe PID 2028 wrote to memory of 1216 2028 raserver.exe cmd.exe PID 2028 wrote to memory of 1216 2028 raserver.exe cmd.exe PID 2028 wrote to memory of 1216 2028 raserver.exe cmd.exe PID 2028 wrote to memory of 1216 2028 raserver.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RFQ_Beijing Chengruisi Manufacturing_pdf.exe"C:\Users\Admin\AppData\Local\Temp\RFQ_Beijing Chengruisi Manufacturing_pdf.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RFQ_Beijing Chengruisi Manufacturing_pdf.exe"C:\Users\Admin\AppData\Local\Temp\RFQ_Beijing Chengruisi Manufacturing_pdf.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\raserver.exe"C:\Windows\SysWOW64\raserver.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\RFQ_Beijing Chengruisi Manufacturing_pdf.exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1180-69-0x0000000006330000-0x0000000006497000-memory.dmpFilesize
1.4MB
-
memory/1180-79-0x0000000007420000-0x000000000758A000-memory.dmpFilesize
1.4MB
-
memory/1180-71-0x0000000004C60000-0x0000000004D24000-memory.dmpFilesize
784KB
-
memory/1216-76-0x0000000000000000-mapping.dmp
-
memory/1680-70-0x0000000000240000-0x0000000000251000-memory.dmpFilesize
68KB
-
memory/1680-68-0x0000000000200000-0x0000000000211000-memory.dmpFilesize
68KB
-
memory/1680-66-0x000000000041D420-mapping.dmp
-
memory/1680-67-0x0000000000A20000-0x0000000000D23000-memory.dmpFilesize
3.0MB
-
memory/1680-65-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1696-63-0x00000000055B0000-0x000000000560C000-memory.dmpFilesize
368KB
-
memory/1696-59-0x0000000000190000-0x0000000000191000-memory.dmpFilesize
4KB
-
memory/1696-64-0x0000000001F70000-0x0000000001F9C000-memory.dmpFilesize
176KB
-
memory/1696-62-0x0000000000310000-0x0000000000314000-memory.dmpFilesize
16KB
-
memory/1696-61-0x00000000002D0000-0x00000000002D1000-memory.dmpFilesize
4KB
-
memory/2028-72-0x0000000000000000-mapping.dmp
-
memory/2028-73-0x0000000075211000-0x0000000075213000-memory.dmpFilesize
8KB
-
memory/2028-74-0x0000000000A40000-0x0000000000A5C000-memory.dmpFilesize
112KB
-
memory/2028-75-0x00000000000C0000-0x00000000000E9000-memory.dmpFilesize
164KB
-
memory/2028-77-0x0000000001FF0000-0x00000000022F3000-memory.dmpFilesize
3.0MB
-
memory/2028-78-0x0000000000900000-0x0000000000990000-memory.dmpFilesize
576KB